Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I have a linux box with two wireless interfaces, one is a station and the other an AP.

wlan0 (station) - Connected to the internet connection

wlan1 (AP) - Other clients connect to it.

I would like for clients connected to wlan1 to be able to access the internet on wlan0. And I'd like to do this with iptables as my kernel doesn't have bridging support...

Here's what I've tried so far with iptables but it's not working:

iptables -A FORWARD -i wlan0 -o wlan1 -j ACCEPT
iptables -A FORWARD -i wlan1 -o wlan0 -j ACCEPT

I'd appreciate any help.

share|improve this question

closed as off topic by Zoredache, Michael Hampton, Scott Pack, Ward, RobM Nov 1 '12 at 21:43

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

IPTABLES is a stateful packet-filter, it permits/drops/mangles packets. It is not a router, or bridge. Your commands adjust the firewall to permit the traffic, but they do not do anything to actually forward it. – Zoredache Sep 25 '12 at 1:19
So replace the kernel with one that has the features you need. It is "a linux box," after all. – Michael Hampton Sep 25 '12 at 1:21
Ah thanks for clarifying! – broody Sep 25 '12 at 1:34
Can I achieve what I'm trying to do with 'route'? I'll look into rebuilding the kernel with bridge support as well but wondering if there are other options. – broody Sep 25 '12 at 1:39
Route tells it where to go once it's enabled. Michael told you what you need to do to support routing. THEN you need to turn it on via sysctl. – Magellan Sep 25 '12 at 2:04
up vote 9 down vote accepted

First, to enable hosts connecting on your private interface to go out to the internet, you don't need bridging the interfaces, you need to route packets coming in on one interface, to the other one, where they go out to the wild.

To do that, you only need to:

  1. Enable forwarding on your linux box:
  2. Allow specific (or all of it) packets to traverse your router
  3. As someone stated, as netfilter is a stateless firewall, allow traffic for already established connections
  4. Change the source address on packets going out to the internet
    echo 1 > /proc/sys/net/ipv4/ip_forward
    iptables -A FORWARD -i wlan1 -o wlan0 -j ACCEPT
    iptables -A FORWARD -i wlan0 -o wlan1 -m state --state ESTABLISHED,RELATED \
             -j ACCEPT
    iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

That should do it.

share|improve this answer
I think that you probably mean: echo 1 >/proc/sys/net/ipv4/ip_forward for the first line – Jason Tan Sep 25 '12 at 4:04
that's it ... don't know what happened to the last part of that line ... corrected. – Torian Sep 25 '12 at 4:06
I think you'd also have to set the clients to use the linux box as their gateway. – Jason Tan Sep 25 '12 at 4:06
And to make the forwarding persist through reboots you want to do this: 'echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf' – Jason Tan Sep 25 '12 at 4:08
I guessed that was out of the question, if the clients where connected via wifi to this so called router. – Torian Sep 25 '12 at 4:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.